Evil Twin Attacks: How They Work and How to Stay Safe

Imagine, if you will, that you’re hooked on a soap opera. For years, your favorite character has been Wiley Finlay — a dashing, handsome, and reliable hero. However, he begins to act out of character. He looks like Finlay, he sounds the same, but Wiley Finlay now has a mustache to twirl and takes part in all sorts of dastardly deeds. A big season finale reveal shows that this character is actually Riley Finlay…Wiley Finlay’s evil twin. You may wonder where we’re going with this illustration. Well, it turns out, when you access a familiar Wi-Fi network, it may have an evil twin out there, waiting to attack. Signing onto a public Wi-Fi network? Beware of evil twin attacks! These hacks play on our trust, but you can protect yourself if you know how. Evil twin attacks are a method used by nefarious hackers to lure unsuspecting users of public Wi-Fi. They mine your data and breach your security to gain access to protected information like your passwords, your bank account, your tax returns, and your Social Security number. Evil twin attacks have the potential to wreak havoc through your life. These attacks mirror real, secure networks, and typically occur within public Wi-Fi networks. An evil twin will show a network name and address that looks almost identical to a legitimate public network. The goal is to trick those attempting to connect to a Starbucks Wi-Fi, an airport domain, or another open public network. It’s tricky to differentiate between these bogus networks and valid networks offered in public spaces. Evil twin hackers can set up their fake hotspots from a phone or a tablet. And they often operate in the open. The creepy guy next to you at the coffee shop who keeps staring your way? He might not be stalking you, but he could be after your internet data. Captive portals are used by many companies that operate online. These are the pages you’re directed to that require a password and other log-in details to connect you to a public network. They can act as extra security measures and help users to feel protected. If you access a public network that doesn’t prompt you to enter a password or read a service agreement, it may mean that the network is not secure. However, although an evil twin can clone an open network, if you haven’t entered any password protected sites, they’re less likely to access your personal data. An evil twin takes advantage of this protocol by using the same Wi-Fi name as the recognizable public network name and setting up a fake captive portal. Even with antivirus and firewall measures, your laptop or tablet may not be able to distinguish between the valid network and the impostor. Here’s a tip to protect yourself. When you bring up the menu, look for the “secure” notation (typically a lock icon) by a network’s name. Once an evil twin hacker sets up a fake network, they will try to place their hotspot device as close to as many users as possible — for instance, the center table in a busy coffee shop. Again, any smart device can be used to set up an evil twin access point. Hackers can use phones, tablets, or laptops. This allows the evil twin to lure in as many users as possible. Without thinking, you may click on “available networks.” If you see two Bob’s Coffee access points pop up, you’re probably more apt to click on the option with the strongest Wi-Fi signal. If the evil twin hacker has set up shop in closer proximity to you than the shop’s router, their signal will appear the strongest. A great day for an evil twin will see a multitude of hacked devices within a small window of time. Evil twins may also use a Wi-Fi Pineapple to expand the range of the computers they can attack. A Wi-Fi Pineapple is an auditing platform that exposes network security vulnerabilities that evil twin attackers may use as a way into your system. Hackers utilizing this platform don’t need to remain as close to your device to emit a strong network signal. Thus, more users may click on their evil twin network. Ironically, Wi-Fi Pineapple is a tool marketed to network security administrators. Evil twin attacks and man in the middle (MitM) attacks routinely use Wi-Fi Pineapple to set up fake network addresses. Once you’ve suffered an evil twin attack, it may be days or weeks before you have any idea it occurred. An evil twin hacker will collect as many of your login and personal credentials as possible. Then they will store them and slip away undetected. If you’ve logged onto your bank account or have made an online payment from an evil twin posing as a public network, a hacker can easily obtain your sensitive information. Weeks later, you might discover new credit cards have been opened in your name. Or perhaps your passwords have changed on secured sites that you visit. An evil twin hacker can also secretly install malware on your operating system. After using a public Wi-Fi network, make sure you run your software security program to check for viruses or malware. If you’ve inadvertently logged into private sites via a public Wi-Fi network, monitor your accounts closely. Look for fraudulent charges or sites that you use frequently which no longer recognize your password or username. The good news is, there are steps you can take if you discover you’ve been a victim of an evil twin attack. After an attack, you should : It’s vital to understand ways to protect your online access from a variety of hacker attacks. While it may prove difficult to identify an evil twin attack before it occurs, you can protect yourself from falling victim to Riley Finlay and his malevolent intentions. You can protect yourself by taking the following steps: Evil twins like to show off — they often strike in public. However, the further away your device is from their access point, the less likely you are to fall for an evil twin trap. When you’re logging into any network, pay close attention to the details and to your surroundings. It’s best to sit away from others whenever possible. These hackers typically work alone, but they know what they’re doing. Follow the steps above to protect yourself from evil twin attacks. And remember: At first glance, evil twins look exactly like their good, authentic counterparts.